Annotation of embedaddon/sudo/doc/sudoers.ldap.mdoc.in, revision 1.1
1.1 ! misho 1: .\"
! 2: .\" Copyright (c) 2003-2012 Todd C. Miller <Todd.Miller@courtesan.com>
! 3: .\"
! 4: .\" Permission to use, copy, modify, and distribute this software for any
! 5: .\" purpose with or without fee is hereby granted, provided that the above
! 6: .\" copyright notice and this permission notice appear in all copies.
! 7: .\"
! 8: .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
! 9: .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
! 10: .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
! 11: .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
! 12: .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
! 13: .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
! 14: .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
! 15: .\" ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 16: .\"
! 17: .Dd July 12, 2012
! 18: .Dt SUDOERS.LDAP @mansectsu@
! 19: .Os Sudo @PACKAGE_VERSION@
! 20: .Sh NAME
! 21: .Nm sudoers.ldap
! 22: .Nd sudo LDAP configuration
! 23: .Sh DESCRIPTION
! 24: In addition to the standard
! 25: .Em sudoers
! 26: file,
! 27: .Nm sudo
! 28: may be configured
! 29: via LDAP.
! 30: This can be especially useful for synchronizing
! 31: .Em sudoers
! 32: in a large, distributed environment.
! 33: .Pp
! 34: Using LDAP for
! 35: .Em sudoers
! 36: has several benefits:
! 37: .Bl -bullet
! 38: .It
! 39: .Nm sudo
! 40: no longer needs to read
! 41: .Em sudoers
! 42: in its entirety.
! 43: When LDAP is used, there are only two or three LDAP queries per invocation.
! 44: This makes it especially fast and particularly usable in LDAP environments.
! 45: .It
! 46: .Nm sudo
! 47: no longer exits if there is a typo in
! 48: .Em sudoers .
! 49: It is not possible to load LDAP data into the server that does
! 50: not conform to the sudoers schema, so proper syntax is guaranteed.
! 51: It is still possible to have typos in a user or host name, but
! 52: this will not prevent
! 53: .Nm sudo
! 54: from running.
! 55: .It
! 56: It is possible to specify per-entry options that override the global
! 57: default options.
! 58: .Pa @sysconfdir@/sudoers
! 59: only supports default options and limited options associated with
! 60: user/host/commands/aliases.
! 61: The syntax is complicated and can be difficult for users to understand.
! 62: Placing the options directly in the entry is more natural.
! 63: .It
! 64: The
! 65: .Nm visudo
! 66: program is no longer needed.
! 67: .Nm visudo
! 68: provides locking and syntax checking of the
! 69: .Pa @sysconfdir@/sudoers
! 70: file.
! 71: Since LDAP updates are atomic, locking is no longer necessary.
! 72: Because syntax is checked when the data is inserted into LDAP, there
! 73: is no need for a specialized tool to check syntax.
! 74: .El
! 75: .Pp
! 76: Another major difference between LDAP and file-based
! 77: .Em sudoers
! 78: is that in LDAP,
! 79: .Nm sudo Ns No -specific
! 80: Aliases are not supported.
! 81: .Pp
! 82: For the most part, there is really no need for
! 83: .Nm sudo Ns No -specific
! 84: Aliases.
! 85: Unix groups or user netgroups can be used in place of User_Aliases and
! 86: Runas_Aliases.
! 87: Host netgroups can be used in place of Host_Aliases.
! 88: Since Unix groups and netgroups can also be stored in LDAP there is no
! 89: real need for
! 90: .Nm sudo Ns No -specific
! 91: aliases.
! 92: .Pp
! 93: Cmnd_Aliases are not really required either since it is possible
! 94: to have multiple users listed in a
! 95: .Li sudoRole .
! 96: Instead of defining a Cmnd_Alias that is referenced by multiple users,
! 97: one can create a
! 98: .Li sudoRole
! 99: that contains the commands and assign multiple users to it.
! 100: .Ss SUDOers LDAP container
! 101: The
! 102: .Em sudoers
! 103: configuration is contained in the
! 104: .Li ou=SUDOers
! 105: LDAP container.
! 106: .Pp
! 107: Sudo first looks for the
! 108: .Li cn=default
! 109: entry in the SUDOers container.
! 110: If found, the multi-valued
! 111: .Li sudoOption
! 112: attribute is parsed in the same manner as a global
! 113: .Li Defaults
! 114: line in
! 115: .Pa @sysconfdir@/sudoers .
! 116: In the following example, the
! 117: .Ev SSH_AUTH_SOCK
! 118: variable will be preserved in the environment for all users.
! 119: .Bd -literal -offset 4n
! 120: dn: cn=defaults,ou=SUDOers,dc=example,dc=com
! 121: objectClass: top
! 122: objectClass: sudoRole
! 123: cn: defaults
! 124: description: Default sudoOption's go here
! 125: sudoOption: env_keep+=SSH_AUTH_SOCK
! 126: .Ed
! 127: .Pp
! 128: The equivalent of a sudoer in LDAP is a
! 129: .Li sudoRole .
! 130: It consists of the following attributes:
! 131: .Bl -tag -width 4n
! 132: .It Sy sudoUser
! 133: A user name, user ID (prefixed with
! 134: .Ql # ) ,
! 135: Unix group (prefixed with
! 136: .Ql % ) ,
! 137: Unix group ID (prefixed with
! 138: .Ql %# ) ,
! 139: or user netgroup (prefixed with
! 140: .Ql + ) .
! 141: .It Sy sudoHost
! 142: A host name, IP address, IP network, or host netgroup (prefixed with a
! 143: .Ql + ) .
! 144: The special value
! 145: .Li ALL
! 146: will match any host.
! 147: .It Sy sudoCommand
! 148: A Unix command with optional command line arguments, potentially
! 149: including globbing characters (aka wild cards).
! 150: The special value
! 151: .Li ALL
! 152: will match any command.
! 153: If a command is prefixed with an exclamation point
! 154: .Ql \&! ,
! 155: the user will be prohibited from running that command.
! 156: .It Sy sudoOption
! 157: Identical in function to the global options described above, but
! 158: specific to the
! 159: .Li sudoRole
! 160: in which it resides.
! 161: .It Sy sudoRunAsUser
! 162: A user name or uid (prefixed with
! 163: .Ql # )
! 164: that commands may be run as or a Unix group (prefixed with a
! 165: .Ql % )
! 166: or user netgroup (prefixed with a
! 167: .Ql + )
! 168: that contains a list of users that commands may be run as.
! 169: The special value
! 170: .Li ALL
! 171: will match any user.
! 172: .Pp
! 173: The
! 174: .Li sudoRunAsUser
! 175: attribute is only available in
! 176: .Nm sudo
! 177: versions
! 178: 1.7.0 and higher.
! 179: Older versions of
! 180: .Nm sudo
! 181: use the
! 182: .Li sudoRunAs
! 183: attribute instead.
! 184: .It Sy sudoRunAsGroup
! 185: A Unix group or gid (prefixed with
! 186: .Ql # )
! 187: that commands may be run as.
! 188: The special value
! 189: .Li ALL
! 190: will match any group.
! 191: .Pp
! 192: The
! 193: .Li sudoRunAsGroup
! 194: attribute is only available in
! 195: .Nm sudo
! 196: versions
! 197: 1.7.0 and higher.
! 198: .It Sy sudoNotBefore
! 199: A timestamp in the form
! 200: .Li yyyymmddHHMMSSZ
! 201: that can be used to provide a start date/time for when the
! 202: .Li sudoRole
! 203: will be valid.
! 204: If multiple
! 205: .Li sudoNotBefore
! 206: entries are present, the earliest is used.
! 207: Note that timestamps must be in Coordinated Universal Time (UTC),
! 208: not the local timezone.
! 209: The minute and seconds portions are optional, but some LDAP servers
! 210: require that they be present (contrary to the RFC).
! 211: .Pp
! 212: The
! 213: .Li sudoNotBefore
! 214: attribute is only available in
! 215: .Nm sudo
! 216: versions 1.7.5 and higher and must be explicitly enabled via the
! 217: .Sy SUDOERS_TIMED
! 218: option in
! 219: .Pa @ldap_conf@ .
! 220: .It Sy sudoNotAfter
! 221: A timestamp in the form
! 222: .Li yyyymmddHHMMSSZ
! 223: that indicates an expiration date/time, after which the
! 224: .Li sudoRole
! 225: will no longer be valid.
! 226: If multiple
! 227: .Li sudoNotBefore
! 228: entries are present, the last one is used.
! 229: Note that timestamps must be in Coordinated Universal Time (UTC),
! 230: not the local timezone.
! 231: The minute and seconds portions are optional, but some LDAP servers
! 232: require that they be present (contrary to the RFC).
! 233: .Pp
! 234: The
! 235: .Li sudoNotAfter
! 236: attribute is only available in
! 237: .Nm sudo
! 238: versions
! 239: 1.7.5 and higher and must be explicitly enabled via the
! 240: .Sy SUDOERS_TIMED
! 241: option in
! 242: .Pa @ldap_conf@ .
! 243: .It Sy sudoOrder
! 244: The
! 245: .Li sudoRole
! 246: entries retrieved from the LDAP directory have no inherent order.
! 247: The
! 248: .Li sudoOrder
! 249: attribute is an integer (or floating point value for LDAP servers
! 250: that support it) that is used to sort the matching entries.
! 251: This allows LDAP-based sudoers entries to more closely mimic the behaviour
! 252: of the sudoers file, where the of the entries influences the result.
! 253: If multiple entries match, the entry with the highest
! 254: .Li sudoOrder
! 255: attribute is chosen.
! 256: This corresponds to the
! 257: .Dq last match
! 258: behavior of the sudoers file.
! 259: If the
! 260: .Li sudoOrder
! 261: attribute is not present, a value of 0 is assumed.
! 262: .Pp
! 263: The
! 264: .Li sudoOrder
! 265: attribute is only available in
! 266: .Nm sudo
! 267: versions 1.7.5 and higher.
! 268: .El
! 269: .Pp
! 270: Each attribute listed above should contain a single value, but there
! 271: may be multiple instances of each attribute type.
! 272: A
! 273: .Li sudoRole
! 274: must contain at least one
! 275: .Li sudoUser ,
! 276: .Li sudoHost
! 277: and
! 278: .Li sudoCommand .
! 279: .Pp
! 280: The following example allows users in group wheel to run any command
! 281: on any host via
! 282: .Nm sudo :
! 283: .Bd -literal -offset 4n
! 284: dn: cn=%wheel,ou=SUDOers,dc=example,dc=com
! 285: objectClass: top
! 286: objectClass: sudoRole
! 287: cn: %wheel
! 288: sudoUser: %wheel
! 289: sudoHost: ALL
! 290: sudoCommand: ALL
! 291: .Ed
! 292: .Ss Anatomy of LDAP sudoers lookup
! 293: When looking up a sudoer using LDAP there are only two or three
! 294: LDAP queries per invocation.
! 295: The first query is to parse the global options.
! 296: The second is to match against the user's name and the groups that
! 297: the user belongs to.
! 298: (The special
! 299: .Li ALL
! 300: tag is matched in this query too.)
! 301: If no match is returned for the user's name and groups, a third
! 302: query returns all entries containing user netgroups and checks
! 303: to see if the user belongs to any of them.
! 304: .Pp
! 305: If timed entries are enabled with the
! 306: .Sy SUDOERS_TIMED
! 307: configuration directive, the LDAP queries include a subfilter that
! 308: limits retrieval to entries that satisfy the time constraints, if any.
! 309: .Ss Differences between LDAP and non-LDAP sudoers
! 310: There are some subtle differences in the way sudoers is handled
! 311: once in LDAP.
! 312: Probably the biggest is that according to the RFC, LDAP ordering
! 313: is arbitrary and you cannot expect that Attributes and Entries are
! 314: returned in any specific order.
! 315: .Pp
! 316: The order in which different entries are applied can be controlled
! 317: using the
! 318: .Li sudoOrder
! 319: attribute, but there is no way to guarantee the order of attributes
! 320: within a specific entry.
! 321: If there are conflicting command rules in an entry, the negative
! 322: takes precedence.
! 323: This is called paranoid behavior (not necessarily the most specific
! 324: match).
! 325: .Pp
! 326: Here is an example:
! 327: .Bd -literal -offset 4n
! 328: # /etc/sudoers:
! 329: # Allow all commands except shell
! 330: johnny ALL=(root) ALL,!/bin/sh
! 331: # Always allows all commands because ALL is matched last
! 332: puddles ALL=(root) !/bin/sh,ALL
! 333:
! 334: # LDAP equivalent of johnny
! 335: # Allows all commands except shell
! 336: dn: cn=role1,ou=Sudoers,dc=my-domain,dc=com
! 337: objectClass: sudoRole
! 338: objectClass: top
! 339: cn: role1
! 340: sudoUser: johnny
! 341: sudoHost: ALL
! 342: sudoCommand: ALL
! 343: sudoCommand: !/bin/sh
! 344:
! 345: # LDAP equivalent of puddles
! 346: # Notice that even though ALL comes last, it still behaves like
! 347: # role1 since the LDAP code assumes the more paranoid configuration
! 348: dn: cn=role2,ou=Sudoers,dc=my-domain,dc=com
! 349: objectClass: sudoRole
! 350: objectClass: top
! 351: cn: role2
! 352: sudoUser: puddles
! 353: sudoHost: ALL
! 354: sudoCommand: !/bin/sh
! 355: sudoCommand: ALL
! 356: .Ed
! 357: .Pp
! 358: Another difference is that negations on the Host, User or Runas are
! 359: currently ignored.
! 360: For example, the following attributes do not behave the way one might expect.
! 361: .Bd -literal -offset 4n
! 362: # does not match all but joe
! 363: # rather, does not match anyone
! 364: sudoUser: !joe
! 365:
! 366: # does not match all but joe
! 367: # rather, matches everyone including Joe
! 368: sudoUser: ALL
! 369: sudoUser: !joe
! 370:
! 371: # does not match all but web01
! 372: # rather, matches all hosts including web01
! 373: sudoHost: ALL
! 374: sudoHost: !web01
! 375: .Ed
! 376: .Ss Sudoers schema
! 377: In order to use
! 378: .Nm sudo Ns No 's
! 379: LDAP support, the
! 380: .Nm sudo
! 381: schema must be
! 382: installed on your LDAP server.
! 383: In addition, be sure to index the
! 384: .Li sudoUser
! 385: attribute.
! 386: .Pp
! 387: Three versions of the schema: one for OpenLDAP servers
! 388: .Pq Pa schema.OpenLDAP ,
! 389: one for Netscape-derived servers
! 390: .Pq Pa schema.iPlanet ,
! 391: and one for Microsoft Active Directory
! 392: .Pq Pa schema.ActiveDirectory
! 393: may be found in the
! 394: .Nm sudo
! 395: distribution.
! 396: .Pp
! 397: The schema for
! 398: .Nm sudo
! 399: in OpenLDAP form is also included in the
! 400: .Sx EXAMPLES
! 401: section.
! 402: .Ss Configuring ldap.conf
! 403: Sudo reads the
! 404: .Pa @ldap_conf@
! 405: file for LDAP-specific configuration.
! 406: Typically, this file is shared amongst different LDAP-aware clients.
! 407: As such, most of the settings are not
! 408: .Nm sudo Ns No -specific.
! 409: Note that
! 410: .Nm sudo
! 411: parses
! 412: .Pa @ldap_conf@
! 413: itself and may support options that differ from those described in the
! 414: system's
! 415: .Xr ldap.conf @mansectsu@
! 416: manual.
! 417: .Pp
! 418: Also note that on systems using the OpenLDAP libraries, default
! 419: values specified in
! 420: .Pa /etc/openldap/ldap.conf
! 421: or the user's
! 422: .Pa .ldaprc
! 423: files are not used.
! 424: .Pp
! 425: Only those options explicitly listed in
! 426: .Pa @ldap_conf@
! 427: as being supported by
! 428: .Nm sudo
! 429: are honored.
! 430: Configuration options are listed below in upper case but are parsed
! 431: in a case-independent manner.
! 432: .Bl -tag -width 4n
! 433: .It Sy URI Ar ldap[s]://[hostname[:port]] ...
! 434: Specifies a whitespace-delimited list of one or more URIs describing
! 435: the LDAP server(s) to connect to.
! 436: The
! 437: .Em protocol
! 438: may be either
! 439: .Em ldap
! 440: .Em ldaps ,
! 441: the latter being for servers that support TLS (SSL) encryption.
! 442: If no
! 443: .Em port
! 444: is specified, the default is port 389 for
! 445: .Li ldap://
! 446: or port 636 for
! 447: .Li ldaps:// .
! 448: If no
! 449: .Em hostname
! 450: is specified,
! 451: .Nm sudo
! 452: will connect to
! 453: .Em localhost .
! 454: Multiple
! 455: .Sy URI
! 456: lines are treated identically to a
! 457: .Sy URI
! 458: line containing multiple entries.
! 459: Only systems using the OpenSSL libraries support the mixing of
! 460: .Li ldap://
! 461: and
! 462: .Li ldaps://
! 463: URIs.
! 464: Both the Netscape-derived and Tivoli LDAP libraries used on most commercial
! 465: versions of Unix are only capable of supporting one or the other.
! 466: .It Sy HOST Ar name[:port] ...
! 467: If no
! 468: .Sy URI
! 469: is specified, the
! 470: .Sy HOST
! 471: parameter specifies a whitespace-delimited list of LDAP servers to connect to.
! 472: Each host may include an optional
! 473: .Em port
! 474: separated by a colon
! 475: .Pq Ql :\& .
! 476: The
! 477: .Sy HOST
! 478: parameter is deprecated in favor of the
! 479: .Sy URI
! 480: specification and is included for backwards compatibility.
! 481: .It Sy PORT Ar port_number
! 482: If no
! 483: .Sy URI
! 484: is specified, the
! 485: .Sy PORT
! 486: parameter specifies the default port to connect to on the LDAP server if a
! 487: .Sy HOST
! 488: parameter does not specify the port itself.
! 489: If no
! 490: .Sy PORT
! 491: parameter is used, the default is port 389 for LDAP and port 636 for LDAP
! 492: over TLS (SSL).
! 493: The
! 494: .Sy PORT
! 495: parameter is deprecated in favor of the
! 496: .Sy URI
! 497: specification and is included for backwards compatibility.
! 498: .It Sy BIND_TIMELIMIT Ar seconds
! 499: The
! 500: .Sy BIND_TIMELIMIT
! 501: parameter specifies the amount of time, in seconds, to wait while trying
! 502: to connect to an LDAP server.
! 503: If multiple
! 504: .Sy URI Ns No s
! 505: or
! 506: .Sy HOST Ns No s
! 507: are specified, this is the amount of time to wait before trying
! 508: the next one in the list.
! 509: .It Sy NETWORK_TIMEOUT Ar seconds
! 510: An alias for
! 511: .Sy BIND_TIMELIMIT
! 512: for OpenLDAP compatibility.
! 513: .It Sy TIMELIMIT Ar seconds
! 514: The
! 515: .Sy TIMELIMIT
! 516: parameter specifies the amount of time, in seconds, to wait for a
! 517: response to an LDAP query.
! 518: .It Sy TIMEOUT Ar seconds
! 519: The
! 520: .Sy TIMEOUT
! 521: parameter specifies the amount of time, in seconds, to wait for a
! 522: response from the various LDAP APIs.
! 523: .It Sy SUDOERS_BASE Ar base
! 524: The base DN to use when performing
! 525: .Nm sudo
! 526: LDAP queries.
! 527: Typically this is of the form
! 528: .Li ou=SUDOers,dc=example,dc=com
! 529: for the domain
! 530: .Li example.com .
! 531: Multiple
! 532: .Sy SUDOERS_BASE
! 533: lines may be specified, in which case they are queried in the order specified.
! 534: .It Sy SUDOERS_SEARCH_FILTER Ar ldap_filter
! 535: An LDAP filter which is used to restrict the set of records returned
! 536: when performing a
! 537: .Nm sudo
! 538: LDAP query.
! 539: Typically, this is of the
! 540: form
! 541: .Li attribute=value
! 542: or
! 543: .Li (&(attribute=value)(attribute2=value2)) .
! 544: .It Sy SUDOERS_TIMED Ar on/true/yes/off/false/no
! 545: Whether or not to evaluate the
! 546: .Li sudoNotBefore
! 547: and
! 548: .Li sudoNotAfter
! 549: attributes that implement time-dependent sudoers entries.
! 550: .It Sy SUDOERS_DEBUG Ar debug_level
! 551: This sets the debug level for
! 552: .Nm sudo
! 553: LDAP queries.
! 554: Debugging information is printed to the standard error.
! 555: A value of 1 results in a moderate amount of debugging information.
! 556: A value of 2 shows the results of the matches themselves.
! 557: This parameter should not be set in a production environment as the
! 558: extra information is likely to confuse users.
! 559: .It Sy BINDDN Ar DN
! 560: The
! 561: .Sy BINDDN
! 562: parameter specifies the identity, in the form of a Distinguished Name (DN),
! 563: to use when performing LDAP operations.
! 564: If not specified, LDAP operations are performed with an anonymous identity.
! 565: By default, most LDAP servers will allow anonymous access.
! 566: .It Sy BINDPW Ar secret
! 567: The
! 568: .Sy BINDPW
! 569: parameter specifies the password to use when performing LDAP operations.
! 570: This is typically used in conjunction with the
! 571: .Sy BINDDN
! 572: parameter.
! 573: .It Sy ROOTBINDDN Ar DN
! 574: The
! 575: .Sy ROOTBINDDN
! 576: parameter specifies the identity, in the form of a Distinguished Name (DN),
! 577: to use when performing privileged LDAP operations, such as
! 578: .Em sudoers
! 579: queries.
! 580: The password corresponding
! 581: to the identity should be stored in
! 582: .Pa @ldap_secret@ .
! 583: If not specified, the
! 584: .Sy BINDDN
! 585: identity is used (if any).
! 586: .It Sy LDAP_VERSION Ar number
! 587: The version of the LDAP protocol to use when connecting to the server.
! 588: The default value is protocol version 3.
! 589: .It Sy SSL Ar on/true/yes/off/false/no
! 590: If the
! 591: .Sy SSL
! 592: parameter is set to
! 593: .Li on ,
! 594: .Li true
! 595: .Li or
! 596: .Li yes ,
! 597: TLS (SSL) encryption is always used when communicating with the LDAP server.
! 598: Typically, this involves connecting to the server on port 636 (ldaps).
! 599: .It Sy SSL Ar start_tls
! 600: If the
! 601: .Sy SSL
! 602: parameter is set to
! 603: .Li start_tls ,
! 604: the LDAP server connection is initiated normally and TLS encryption is
! 605: begun before the bind credentials are sent.
! 606: This has the advantage of not requiring a dedicated port for encrypted
! 607: communications.
! 608: This parameter is only supported by LDAP servers that honor the
! 609: .Em start_tls
! 610: extension, such as the OpenLDAP and Tivoli Directory servers.
! 611: .It Sy TLS_CHECKPEER Ar on/true/yes/off/false/no
! 612: If enabled,
! 613: .Sy TLS_CHECKPEER
! 614: will cause the LDAP server's TLS certificated to be verified.
! 615: If the server's TLS certificate cannot be verified (usually because it
! 616: is signed by an unknown certificate authority),
! 617: .Nm sudo
! 618: will be unable to connect to it.
! 619: If
! 620: .Sy TLS_CHECKPEER
! 621: is disabled, no check is made.
! 622: Note that disabling the check creates an opportunity for man-in-the-middle
! 623: attacks since the server's identity will not be authenticated.
! 624: If possible, the CA's certificate should be installed locally so it can
! 625: be verified.
! 626: This option is not supported by the Tivoli Directory Server LDAP libraries.
! 627: .It Sy TLS_CACERT Ar file name
! 628: An alias for
! 629: .Sy TLS_CACERTFILE
! 630: for OpenLDAP compatibility.
! 631: .It Sy TLS_CACERTFILE Ar file name
! 632: The path to a certificate authority bundle which contains the certificates
! 633: for all the Certificate Authorities the client knows to be valid, e.g.\&
! 634: .Pa /etc/ssl/ca-bundle.pem .
! 635: This option is only supported by the OpenLDAP libraries.
! 636: Netscape-derived LDAP libraries use the same certificate
! 637: database for CA and client certificates (see
! 638: .Sy TLS_CERT ) .
! 639: .It Sy TLS_CACERTDIR Ar directory
! 640: Similar to
! 641: .Sy TLS_CACERTFILE
! 642: but instead of a file, it is a directory containing individual
! 643: Certificate Authority certificates, e.g.\&
! 644: .Pa /etc/ssl/certs .
! 645: The directory specified by
! 646: .Sy TLS_CACERTDIR
! 647: is checked after
! 648: .Sy TLS_CACERTFILE .
! 649: This option is only supported by the OpenLDAP libraries.
! 650: .It Sy TLS_CERT Ar file name
! 651: The path to a file containing the client certificate which can
! 652: be used to authenticate the client to the LDAP server.
! 653: The certificate type depends on the LDAP libraries used.
! 654: .Bl -tag -width 4n
! 655: .It OpenLDAP:
! 656: .Li tls_cert /etc/ssl/client_cert.pem
! 657: .It Netscape-derived:
! 658: .Li tls_cert /var/ldap/cert7.db
! 659: .It Tivoli Directory Server:
! 660: Unused, the key database specified by
! 661: .Sy TLS_KEY
! 662: contains both keys and certificates.
! 663: .Pp
! 664: When using Netscape-derived libraries, this file may also contain
! 665: Certificate Authority certificates.
! 666: .El
! 667: .It Sy TLS_KEY Ar file name
! 668: The path to a file containing the private key which matches the
! 669: certificate specified by
! 670: .Sy TLS_CERT .
! 671: The private key must not be password-protected.
! 672: The key type depends on the LDAP libraries used.
! 673: .Bl -tag -width 4n
! 674: .It OpenLDAP:
! 675: .Li tls_key /etc/ssl/client_key.pem
! 676: .It Netscape-derived:
! 677: .Li tls_key /var/ldap/key3.db
! 678: .It Tivoli Directory Server:
! 679: .Li tls_cert /usr/ldap/ldapkey.kdb
! 680: .El
! 681: When using Tivoli LDAP libraries, this file may also contain
! 682: Certificate Authority and client certificates and may be encrypted.
! 683: .It Sy TLS_KEYPW Ar secret
! 684: The
! 685: .Sy TLS_KEYPW
! 686: contains the password used to decrypt the key database on clients
! 687: using the Tivoli Directory Server LDAP library.
! 688: If no
! 689: .Sy TLS_KEYPW
! 690: is specified, a
! 691: .Em stash file
! 692: will be used if it exists.
! 693: The
! 694: .Em stash file
! 695: must have the same path as the file specified by
! 696: .Sy TLS_KEY ,
! 697: but use a
! 698: .Li .sth
! 699: file extension instead of
! 700: .Li .kdb ,
! 701: e.g.\&
! 702: .Li ldapkey.sth .
! 703: The default
! 704: .Li ldapkey.kdb
! 705: that ships with Tivoli Directory Server is encrypted with the password
! 706: .Li ssl_password .
! 707: This option is only supported by the Tivoli LDAP libraries.
! 708: .It Sy TLS_RANDFILE Ar file name
! 709: The
! 710: .Sy TLS_RANDFILE
! 711: parameter specifies the path to an entropy source for systems that lack
! 712: a random device.
! 713: It is generally used in conjunction with
! 714: .Em prngd
! 715: or
! 716: .Em egd .
! 717: This option is only supported by the OpenLDAP libraries.
! 718: .It Sy TLS_CIPHERS Ar cipher list
! 719: The
! 720: .Sy TLS_CIPHERS
! 721: parameter allows the administer to restrict which encryption algorithms
! 722: may be used for TLS (SSL) connections.
! 723: See the OpenLDAP or Tivoli Directory Server manual for a list of valid
! 724: ciphers.
! 725: This option is not supported by Netscape-derived libraries.
! 726: .It Sy USE_SASL Ar on/true/yes/off/false/no
! 727: Enable
! 728: .Sy USE_SASL
! 729: for LDAP servers that support SASL authentication.
! 730: .It Sy SASL_AUTH_ID Ar identity
! 731: The SASL user name to use when connecting to the LDAP server.
! 732: By default,
! 733: .Nm sudo
! 734: will use an anonymous connection.
! 735: .It Sy ROOTUSE_SASL Ar on/true/yes/off/false/no
! 736: Enable
! 737: .Sy ROOTUSE_SASL
! 738: to enable SASL authentication when connecting
! 739: to an LDAP server from a privileged process, such as
! 740: .Nm sudo .
! 741: .It Sy ROOTSASL_AUTH_ID Ar identity
! 742: The SASL user name to use when
! 743: .Sy ROOTUSE_SASL
! 744: is enabled.
! 745: .It Sy SASL_SECPROPS Ar none/properties
! 746: SASL security properties or
! 747: .Em none
! 748: for no properties.
! 749: See the SASL programmer's manual for details.
! 750: .It Sy KRB5_CCNAME Ar file name
! 751: The path to the Kerberos 5 credential cache to use when authenticating
! 752: with the remote server.
! 753: .It Sy DEREF Ar never/searching/finding/always
! 754: How alias dereferencing is to be performed when searching.
! 755: See the
! 756: .Xr ldap.conf @mansectsu@
! 757: manual for a full description of this option.
! 758: .El
! 759: .Pp
! 760: See the
! 761: .Pa ldap.conf
! 762: entry in the
! 763: .Sx EXAMPLES
! 764: section.
! 765: .Ss Configuring nsswitch.conf
! 766: Unless it is disabled at build time,
! 767: .Nm sudo
! 768: consults the Name Service Switch file,
! 769: .Pa @nsswitch_conf@ ,
! 770: to specify the
! 771: .Em sudoers
! 772: search order.
! 773: Sudo looks for a line beginning with
! 774: .Li sudoers :
! 775: and uses this to determine the search order.
! 776: Note that
! 777: .Nm sudo
! 778: does
! 779: not stop searching after the first match and later matches take
! 780: precedence over earlier ones.
! 781: The following sources are recognized:
! 782: .Pp
! 783: .Bl -tag -width 8n -offset 4n -compact
! 784: .It files
! 785: read sudoers from
! 786: .Pa @sysconfdir@/sudoers
! 787: .It ldap
! 788: read sudoers from LDAP
! 789: .El
! 790: .Pp
! 791: In addition, the entry
! 792: .Li [NOTFOUND=return]
! 793: will short-circuit the search if the user was not found in the
! 794: preceding source.
! 795: .Pp
! 796: To consult LDAP first followed by the local sudoers file (if it
! 797: exists), use:
! 798: .Bd -literal -offset 4n
! 799: sudoers: ldap files
! 800: .Ed
! 801: .Pp
! 802: The local
! 803: .Em sudoers
! 804: file can be ignored completely by using:
! 805: .Bd -literal -offset 4n
! 806: sudoers: ldap
! 807: .Ed
! 808: .Pp
! 809: If the
! 810: .Pa @nsswitch_conf@
! 811: file is not present or there is no sudoers line, the following
! 812: default is assumed:
! 813: .Bd -literal -offset 4n
! 814: sudoers: files
! 815: .Ed
! 816: .Pp
! 817: Note that
! 818: .Pa @nsswitch_conf@
! 819: is supported even when the underlying operating system does not use
! 820: an nsswitch.conf file, except on AIX (see below).
! 821: .Ss Configuring netsvc.conf
! 822: On AIX systems, the
! 823: .Pa @netsvc_conf@
! 824: file is consulted instead of
! 825: .Pa @nsswitch_conf@ .
! 826: .Nm sudo
! 827: simply treats
! 828: .Pa netsvc.conf
! 829: as a variant of
! 830: .Pa nsswitch.conf ;
! 831: information in the previous section unrelated to the file format
! 832: itself still applies.
! 833: .Pp
! 834: To consult LDAP first followed by the local sudoers file (if it
! 835: exists), use:
! 836: .Bd -literal -offset 4n
! 837: sudoers = ldap, files
! 838: .Ed
! 839: .Pp
! 840: The local
! 841: .Em sudoers
! 842: file can be ignored completely by using:
! 843: .Bd -literal -offset 4n
! 844: sudoers = ldap
! 845: .Ed
! 846: .Pp
! 847: To treat LDAP as authoratative and only use the local sudoers file
! 848: if the user is not present in LDAP, use:
! 849: .Bd -literal -offset 4n
! 850: sudoers = ldap = auth, files
! 851: .Ed
! 852: .Pp
! 853: Note that in the above example, the
! 854: .Li auth
! 855: qualfier only affects user lookups; both LDAP and
! 856: .Em sudoers
! 857: will be queried for
! 858: .Li Defaults
! 859: entries.
! 860: .Pp
! 861: If the
! 862: .Pa @netsvc_conf@
! 863: file is not present or there is no sudoers line, the following
! 864: default is assumed:
! 865: .Bd -literal -offset 4n
! 866: sudoers = files
! 867: .Ed
! 868: .Sh FILES
! 869: .Bl -tag -width 24n
! 870: .It Pa @ldap_conf@
! 871: LDAP configuration file
! 872: .It Pa @nsswitch_conf@
! 873: determines sudoers source order
! 874: .It Pa @netsvc_conf@
! 875: determines sudoers source order on AIX
! 876: .El
! 877: .Sh EXAMPLES
! 878: .Ss Example ldap.conf
! 879: .Bd -literal -offset 2n
! 880: # Either specify one or more URIs or one or more host:port pairs.
! 881: # If neither is specified sudo will default to localhost, port 389.
! 882: #
! 883: #host ldapserver
! 884: #host ldapserver1 ldapserver2:390
! 885: #
! 886: # Default port if host is specified without one, defaults to 389.
! 887: #port 389
! 888: #
! 889: # URI will override the host and port settings.
! 890: uri ldap://ldapserver
! 891: #uri ldaps://secureldapserver
! 892: #uri ldaps://secureldapserver ldap://ldapserver
! 893: #
! 894: # The amount of time, in seconds, to wait while trying to connect to
! 895: # an LDAP server.
! 896: bind_timelimit 30
! 897: #
! 898: # The amount of time, in seconds, to wait while performing an LDAP query.
! 899: timelimit 30
! 900: #
! 901: # Must be set or sudo will ignore LDAP; may be specified multiple times.
! 902: sudoers_base ou=SUDOers,dc=example,dc=com
! 903: #
! 904: # verbose sudoers matching from ldap
! 905: #sudoers_debug 2
! 906: #
! 907: # Enable support for time-based entries in sudoers.
! 908: #sudoers_timed yes
! 909: #
! 910: # optional proxy credentials
! 911: #binddn <who to search as>
! 912: #bindpw <password>
! 913: #rootbinddn <who to search as, uses /etc/ldap.secret for bindpw>
! 914: #
! 915: # LDAP protocol version, defaults to 3
! 916: #ldap_version 3
! 917: #
! 918: # Define if you want to use an encrypted LDAP connection.
! 919: # Typically, you must also set the port to 636 (ldaps).
! 920: #ssl on
! 921: #
! 922: # Define if you want to use port 389 and switch to
! 923: # encryption before the bind credentials are sent.
! 924: # Only supported by LDAP servers that support the start_tls
! 925: # extension such as OpenLDAP.
! 926: #ssl start_tls
! 927: #
! 928: # Additional TLS options follow that allow tweaking of the
! 929: # SSL/TLS connection.
! 930: #
! 931: #tls_checkpeer yes # verify server SSL certificate
! 932: #tls_checkpeer no # ignore server SSL certificate
! 933: #
! 934: # If you enable tls_checkpeer, specify either tls_cacertfile
! 935: # or tls_cacertdir. Only supported when using OpenLDAP.
! 936: #
! 937: #tls_cacertfile /etc/certs/trusted_signers.pem
! 938: #tls_cacertdir /etc/certs
! 939: #
! 940: # For systems that don't have /dev/random
! 941: # use this along with PRNGD or EGD.pl to seed the
! 942: # random number pool to generate cryptographic session keys.
! 943: # Only supported when using OpenLDAP.
! 944: #
! 945: #tls_randfile /etc/egd-pool
! 946: #
! 947: # You may restrict which ciphers are used. Consult your SSL
! 948: # documentation for which options go here.
! 949: # Only supported when using OpenLDAP.
! 950: #
! 951: #tls_ciphers <cipher-list>
! 952: #
! 953: # Sudo can provide a client certificate when communicating to
! 954: # the LDAP server.
! 955: # Tips:
! 956: # * Enable both lines at the same time.
! 957: # * Do not password protect the key file.
! 958: # * Ensure the keyfile is only readable by root.
! 959: #
! 960: # For OpenLDAP:
! 961: #tls_cert /etc/certs/client_cert.pem
! 962: #tls_key /etc/certs/client_key.pem
! 963: #
! 964: # For SunONE or iPlanet LDAP, tls_cert and tls_key may specify either
! 965: # a directory, in which case the files in the directory must have the
! 966: # default names (e.g. cert8.db and key4.db), or the path to the cert
! 967: # and key files themselves. However, a bug in version 5.0 of the LDAP
! 968: # SDK will prevent specific file names from working. For this reason
! 969: # it is suggested that tls_cert and tls_key be set to a directory,
! 970: # not a file name.
! 971: #
! 972: # The certificate database specified by tls_cert may contain CA certs
! 973: # and/or the client's cert. If the client's cert is included, tls_key
! 974: # should be specified as well.
! 975: # For backward compatibility, "sslpath" may be used in place of tls_cert.
! 976: #tls_cert /var/ldap
! 977: #tls_key /var/ldap
! 978: #
! 979: # If using SASL authentication for LDAP (OpenSSL)
! 980: # use_sasl yes
! 981: # sasl_auth_id <SASL user name>
! 982: # rootuse_sasl yes
! 983: # rootsasl_auth_id <SASL user name for root access>
! 984: # sasl_secprops none
! 985: # krb5_ccname /etc/.ldapcache
! 986: .Ed
! 987: .Ss Sudo schema for OpenLDAP
! 988: The following schema, in OpenLDAP format, is included with
! 989: .Nm sudo
! 990: source and binary distributions as
! 991: .Pa schema.OpenLDAP .
! 992: Simply copy
! 993: it to the schema directory (e.g.\&
! 994: .Pa /etc/openldap/schema ) ,
! 995: add the proper
! 996: .Li include
! 997: line in
! 998: .Pa slapd.conf
! 999: and restart
! 1000: .Nm slapd .
! 1001: .Bd -literal -offset 2n
! 1002: attributetype ( 1.3.6.1.4.1.15953.9.1.1
! 1003: NAME 'sudoUser'
! 1004: DESC 'User(s) who may run sudo'
! 1005: EQUALITY caseExactIA5Match
! 1006: SUBSTR caseExactIA5SubstringsMatch
! 1007: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 1008:
! 1009: attributetype ( 1.3.6.1.4.1.15953.9.1.2
! 1010: NAME 'sudoHost'
! 1011: DESC 'Host(s) who may run sudo'
! 1012: EQUALITY caseExactIA5Match
! 1013: SUBSTR caseExactIA5SubstringsMatch
! 1014: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 1015:
! 1016: attributetype ( 1.3.6.1.4.1.15953.9.1.3
! 1017: NAME 'sudoCommand'
! 1018: DESC 'Command(s) to be executed by sudo'
! 1019: EQUALITY caseExactIA5Match
! 1020: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 1021:
! 1022: attributetype ( 1.3.6.1.4.1.15953.9.1.4
! 1023: NAME 'sudoRunAs'
! 1024: DESC 'User(s) impersonated by sudo'
! 1025: EQUALITY caseExactIA5Match
! 1026: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 1027:
! 1028: attributetype ( 1.3.6.1.4.1.15953.9.1.5
! 1029: NAME 'sudoOption'
! 1030: DESC 'Options(s) followed by sudo'
! 1031: EQUALITY caseExactIA5Match
! 1032: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 1033:
! 1034: attributetype ( 1.3.6.1.4.1.15953.9.1.6
! 1035: NAME 'sudoRunAsUser'
! 1036: DESC 'User(s) impersonated by sudo'
! 1037: EQUALITY caseExactIA5Match
! 1038: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 1039:
! 1040: attributetype ( 1.3.6.1.4.1.15953.9.1.7
! 1041: NAME 'sudoRunAsGroup'
! 1042: DESC 'Group(s) impersonated by sudo'
! 1043: EQUALITY caseExactIA5Match
! 1044: SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
! 1045:
! 1046: attributetype ( 1.3.6.1.4.1.15953.9.1.8
! 1047: NAME 'sudoNotBefore'
! 1048: DESC 'Start of time interval for which the entry is valid'
! 1049: EQUALITY generalizedTimeMatch
! 1050: ORDERING generalizedTimeOrderingMatch
! 1051: SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
! 1052:
! 1053: attributetype ( 1.3.6.1.4.1.15953.9.1.9
! 1054: NAME 'sudoNotAfter'
! 1055: DESC 'End of time interval for which the entry is valid'
! 1056: EQUALITY generalizedTimeMatch
! 1057: ORDERING generalizedTimeOrderingMatch
! 1058: SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
! 1059:
! 1060: attributeTypes ( 1.3.6.1.4.1.15953.9.1.10
! 1061: NAME 'sudoOrder'
! 1062: DESC 'an integer to order the sudoRole entries'
! 1063: EQUALITY integerMatch
! 1064: ORDERING integerOrderingMatch
! 1065: SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
! 1066:
! 1067: objectclass ( 1.3.6.1.4.1.15953.9.2.1 NAME 'sudoRole' SUP top STRUCTURAL
! 1068: DESC 'Sudoer Entries'
! 1069: MUST ( cn )
! 1070: MAY ( sudoUser $ sudoHost $ sudoCommand $ sudoRunAs $ sudoRunAsUser $
! 1071: sudoRunAsGroup $ sudoOption $ sudoNotBefore $ sudoNotAfter $
! 1072: sudoOrder $ description )
! 1073: )
! 1074: .Ed
! 1075: .Sh SEE ALSO
! 1076: .Xr ldap.conf @mansectsu@ ,
! 1077: .Xr sudoers @mansectsu@
! 1078: .Sh CAVEATS
! 1079: Note that there are differences in the way that LDAP-based
! 1080: .Em sudoers
! 1081: is parsed compared to file-based
! 1082: .Em sudoers .
! 1083: See the
! 1084: .Sx Differences between LDAP and non-LDAP sudoers
! 1085: section for more information.
! 1086: .Sh BUGS
! 1087: If you feel you have found a bug in
! 1088: .Nm sudo ,
! 1089: please submit a bug report at http://www.sudo.ws/sudo/bugs/
! 1090: .Sh SUPPORT
! 1091: Limited free support is available via the sudo-users mailing list,
! 1092: see http://www.sudo.ws/mailman/listinfo/sudo-users to subscribe or
! 1093: search the archives.
! 1094: .Sh DISCLAIMER
! 1095: .Nm sudo
! 1096: is provided
! 1097: .Dq AS IS
! 1098: and any express or implied warranties, including, but not limited
! 1099: to, the implied warranties of merchantability and fitness for a
! 1100: particular purpose are disclaimed.
! 1101: See the LICENSE file distributed with
! 1102: .Nm sudo
! 1103: or http://www.sudo.ws/sudo/license.html for complete details.
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to sudoers.ldap.mdoc.in CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / sudo / doc